The Shared Login Problem

Why this matters

Most small shops have at least one login that several people use: "office@" for the scheduling software, one bank login the owner and the bookkeeper both know, a "Tech" account on the tablet that every truck signs into. It saves a little money on seats and a little hassle on passwords, and it quietly breaks three things a shop eventually needs. You cannot tell who did what. You cannot remove one person without changing everyone's access. And the second sign-in factor that is supposed to protect the account ends up texting one person's phone, or gets switched off because it was in the way. Splitting shared logins does not have to mean buying a seat for everybody. It means deciding, account by account, who actually needs what.

What a shared login actually breaks

The audit trail. Most business software records who created, changed or deleted a record. That record is called the audit trail, and it is only as precise as the logins behind it. When four people use one account, a deleted invoice, a discount nobody approved or a customer address changed the week before a dispute all come back as "Office". You have not lost the record; you have lost the name on it, which is the part you needed.

Offboarding. When someone leaves, the clean move is to switch off their account the same day. With a shared login there is nothing to switch off. The choices are to change the password and re-issue it to everyone who stays, which nobody does on the day, or leave it alone, which means a former employee keeps working access. See related: The Former Employee Still Had Access.

The second factor. Multifactor authentication (MFA) asks for a second proof, usually a code from a phone, on top of the password. On a shared account the code goes to one person's phone, so either that person becomes a bottleneck for every sign-in or the shop turns MFA off. Either way the account most worth protecting ends up the least protected.

The terms you agreed to. Most software licenses are per named user and say so. Sharing a seat is usually a breach of the subscription terms, and while vendors rarely chase small customers for it, it can surface at the worst moment, such as a support request about a deleted record the vendor can see was made by a shared account.

Four kinds of shared login, four different fixes

Not every shared login is the same problem, and the fix that costs money only applies to one of the four.

1. Seat-licensed software shared to save seats. The field-service platform, the accounting program, the design tool. Fix: give each person their own login, but check the vendor's role list first. Many charge differently for a full office user, a limited or view-only user, and a field or technician user. A lot of people sharing a full seat only need one of the cheaper roles.

2. A vendor portal that only allows one login. Supplier ordering accounts, a permit portal, a utility rebate portal, a parts warranty site. You cannot add users because the site does not support them. Fix: store the login as a shared item in a password manager, shared only with the named people who use it, with the site's MFA set to a method the password manager can hold or to a shared office phone number. When one of those people leaves, change the password and the manager updates it for everyone else. See related: Rolling Out a Password Manager to a Small Crew.

3. A shared mailbox. "info@", "office@", "billing@". Fix: keep the address, drop the shared password. Business email services let you set up a shared mailbox or a group that delivers to several people, each of whom opens it through their own account. Nobody needs the shared mailbox's password, and replies still go out under the shared address.

4. A shared device login. The office computer everyone signs into as "Front Desk", the tablet signed in as "Truck 3". Fix: individual accounts on the office computer, which most operating systems support at no extra cost. For field tablets, the device can stay shared if each tech signs into the apps with their own login, which is where the records are made.

One account type never gets shared at all: online banking. Banks give business customers sub-user logins with their own permissions, so the bookkeeper can view and prepare a payment and the owner approves it. Sharing the owner's banking login throws away the approval control the bank built for you. See related: Setting Up Bank Alerts and Dual Approval for Outgoing Money.

How to split them, in order

1. List every login more than one person uses. Go person by person and ask: what do you sign into for work, and does anyone else use the same login? Write down the account, the people using it and what each one does in it. Why: nobody in a small shop knows the full list, and the owner usually knows least. What breaks if skipped: you fix the logins you remembered and leave the one the departing bookkeeper was using. See related: The Account Inventory Every Shop Should Keep.

2. Sort each into one of the four kinds above. This is where the cost question gets settled: only kind 1 involves buying anything.

3. For seat-licensed software, decide the role per person, not per account. What does each person actually do in it? Creating invoices and changing settings needs a full seat. Looking up a job, reading reports or logging time on a job may need only a limited or field role. What breaks if skipped: you either buy a full seat for everyone, which is what made sharing look attractive in the first place, or you put people on a role that cannot do their job and they start sharing again within a month.

4. Create the individual accounts and turn on MFA for each, before touching the old login. Each person signs in once with their own account while the shared one still works, so a problem with a new account does not stop work.

5. Switch off the shared login, do not just stop using it. Disable or delete it in the software, or change its password to one nobody knows and store it in the password manager under the owner's name for emergencies. An account that is "not used anymore" but still works is the one an attacker finds. What breaks if skipped: the old login keeps working for whoever still knows the password, including everyone who has ever left.

6. Tell people why. One sentence works: "We're each getting our own login so the records show who did what, and so nobody has to change their password when someone leaves." Without it, the new accounts look like suspicion, and people start lending each other their sign-ins.

A worked example

An eleven-person HVAC shop: the owner, two office staff, a dispatcher and seven techs. Its field-service software had two full office seats and one field seat.

• The "Office" login was used by the owner, both office staff and the dispatcher: four people on one full seat.
• An "Admin" login, the second full seat, was used by the owner for settings and by the office manager for payroll exports.
• The "Tech" login, the one field seat, was signed in on all seven truck tablets.

So three accounts covered eleven people. When an unauthorized discount appeared on a large invoice, the audit trail said "Office" and four people could have done it.

Working through step 3, the shop asked what each person did:

• Both office staff create invoices, take payments and edit customers: a full seat each.
• The dispatcher schedules and assigns jobs and never invoices. The vendor offered a dispatch role at a lower tier than a full seat.
• The owner reads reports and changes settings a few times a year. The vendor's admin permission came with a full seat, so the owner took one and the shared "Admin" login was retired.
• The seven techs need the field role: a field seat each.

Before: 2 full seats plus 1 field seat, for 11 people on 3 shared accounts. After: 3 full seats (two office staff and the owner), 1 dispatch seat and 7 field seats, for 11 people on 11 accounts. The full-seat line went from 2 to 3, half again. The field line went from 1 to 7, but that tier was a small fraction of a full seat's price at this vendor, so the bill grew by one full seat, one dispatch seat and six cheap field seats, far less than the nine extra full seats that "a full seat for everyone" would have meant. At a vendor whose field seats are priced like office seats the gap closes, which is why step 3 comes before any purchase.

Three weeks after the split, another unexplained discount turned up. This time the audit trail named the person, the date and the invoice, and the conversation took five minutes instead of a staff meeting. It turned out to be a training gap, not dishonesty, which the old setup could never have shown.

What would change the answer. If the vendor gives no cheaper role at all, every person who enters records still needs their own seat, and the honest move is to cut seats by who enters records rather than by who looks. A person who only needs to see the schedule can often be sent a read-only calendar or a daily report instead of a login.

How to verify it worked

Two tests, both quick. Pick any record changed in the last week and check that the audit trail names one person. Then rehearse an offboarding on paper: if a named person left today, which accounts would you switch off, and would anyone else lose access or need a new password? If the answer to the second part is yes for anything except the password-manager items in kind 2, a shared login is still in the shop.

References

• Your software vendors' license terms and user-role documentation
• CISA guidance on account management and multifactor authentication for small businesses
• See related: Rolling Out a Password Manager to a Small Crew
• See related: The Account Inventory Every Shop Should Keep
• See related: The Employee Offboarding Digital Access SOP